Traditional digital forensics or what is often referred to now as dead box forensics has focused on the hard disk drive taken from a shut down system as the primary source of evidence. This approach works well when addressing criminal activity such as fraud or child exploitation where image files, word processing documents, and spreadsheets can be discovered in a forensically sound manner. The issue with this approach is that to properly acquire this evidence, the system has to be powered off, thereby destroying any potential evidence found within the volatile memory.

As opposed to traditional criminal activity, incident responders will find that a great deal of evidence of a security incident is contained within the memory of a potentially compromised system. This is especially true when examining systems that have been infected with malware or exploited utilizing a common platform such as metasploit. Trace evidence is often found within the memory of the compromised system. As a result, it is critical before powering down the system and removing the hard drive that the running memory is acquired for processing.

There are a number of free and commercial tools that can be leveraged by incident response analysts to acquire the running memory. Which tool is used will often be dependent on the type of techniques and tools that will be used during the analysis phase. Two popular frameworks for analysis of memory images are Rekall and Volatility. Both of these frameworks allow for detailed analysis of memory images.

Running memory can be acquired in two ways. First, memory can be acquired locally via a USB device or other writable medium that is directly connected to the suspect system. The other method to acquiring memory is through a remote connection. This can be facilitated through the use of specialized software that performs the acquisition over a network connection.